General
-
Target
42c12ff0a5776cc9843e3f450b8e524374f25e6bc26d59aea041eb4f23996c56
-
Size
422KB
-
Sample
220521-ax5dyaeaak
-
MD5
0ed0595ce301e4478499a8a555951a3b
-
SHA1
40ab1bb27554fe4dd76bd8bed157c84c1d5ce7f5
-
SHA256
42c12ff0a5776cc9843e3f450b8e524374f25e6bc26d59aea041eb4f23996c56
-
SHA512
bb41c869721187b527bca1bb107e7029bb8cd76e49b95d738eee1c4c1b407f8e8feecb8c1c858ba10682829789ef067591e41b8b2f542b7b88a43753bfbb9eed
Static task
static1
Behavioral task
behavioral1
Sample
DHL_23072020_AWB_998227999_INV..exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL_23072020_AWB_998227999_INV..exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.wtgriderline.com - Port:
587 - Username:
[email protected] - Password:
T@sz^GL3
Targets
-
-
Target
DHL_23072020_AWB_998227999_INV..exe
-
Size
515KB
-
MD5
5d70a20f85b34b8eb7ddd707fe815116
-
SHA1
4710054a6acad00bf114746ec714fed9ed5b6fd5
-
SHA256
4f98dddd1446348937ee177862d015eb8528bb8a7b2aa65cc77cc77a5c689817
-
SHA512
48ff0416757156b0258876a943a12d832171db587822db3ce51a7b552db4163b6b2ba23e42f35aac63fab29bda3b444d7eea6bb5186dbb68b753659ed9f18855
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-